50 lines
2.5 KiB
Bash
50 lines
2.5 KiB
Bash
#!/bin/sh
|
||
# 容器入口（Agent 和 Probe 共用）：第一次启动用 MOSHIRO_SERVER / MOSHIRO_JOIN（MOSHIRO_NAME 不写就用主机名）自己注册并写配置，
|
||
# 身份和配置都在命名卷 /etc/moshiro 里，之后重启（或换新镜像重建容器）直接启动，不需要再给参数。
|
||
set -eu
|
||
|
||
role="${MOSHIRO_ROLE:?MOSHIRO_ROLE is set by the image}"
|
||
# Quadlet 单元和 compose 默认用宿主网络；Docker Desktop（没有宿主网络）的 .env 里写 MOSHIRO_NETWORK_SCOPE=container
|
||
export MOSHIRO_NETWORK_SCOPE="${MOSHIRO_NETWORK_SCOPE:-host}"
|
||
dir=/etc/moshiro
|
||
identity="$dir/$role-id"
|
||
config="$dir/$role.json"
|
||
|
||
if [ ! -f "$identity/node.json" ]; then
|
||
# 节点名字不写就用主机名（宿主网络下容器的主机名就是宿主机的）
|
||
MOSHIRO_NAME="${MOSHIRO_NAME:-$(hostname -s 2>/dev/null || hostname 2>/dev/null || echo node)}"
|
||
if [ -z "${MOSHIRO_SERVER:-}" ] || [ -z "${MOSHIRO_JOIN:-}" ]; then
|
||
echo "first start: set MOSHIRO_SERVER and MOSHIRO_JOIN in .env (the panel shows the complete content)" >&2
|
||
exit 1
|
||
fi
|
||
echo "enrolling as '$MOSHIRO_NAME' (1-64 letters, digits, . _ - ; set MOSHIRO_NAME in .env to choose another)" >&2
|
||
# 每个节点都必须有属主（passkey）：信任根指纹和属主缺一个就不注册
|
||
if [ -z "${MOSHIRO_GENESIS:-}" ] || [ -z "${MOSHIRO_CONTROLLERS:-}" ]; then
|
||
if [ "${MOSHIRO_ALLOW_NO_OWNER:-}" != 1 ]; then
|
||
echo "this node has no owner: set MOSHIRO_GENESIS and MOSHIRO_CONTROLLERS (the panel's command has them; set up the trust root first)" >&2
|
||
exit 1
|
||
fi
|
||
fi
|
||
if [ -n "${MOSHIRO_GENESIS:-}" ]; then
|
||
# 命令里带着信任根指纹和属主（公开值）：先验证面板的操作员集合，并把它们固定在本地
|
||
/usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity" \
|
||
--genesis "$MOSHIRO_GENESIS" --controllers "${MOSHIRO_CONTROLLERS:-}"
|
||
else
|
||
/usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity"
|
||
fi
|
||
fi
|
||
|
||
if [ ! -f "$config" ]; then
|
||
if [ -z "${MOSHIRO_SERVER:-}" ]; then
|
||
echo "$config is missing: set MOSHIRO_SERVER to create it" >&2
|
||
exit 1
|
||
fi
|
||
if [ "$role" = agent ]; then
|
||
printf '{"fleet":{"server":"%s","identity_dir":"%s"},"listen":{"bind":"::"}}\n' "$MOSHIRO_SERVER" "$identity" > "$config"
|
||
else
|
||
printf '{"fleet":{"server":"%s","identity_dir":"%s"}}\n' "$MOSHIRO_SERVER" "$identity" > "$config"
|
||
fi
|
||
fi
|
||
|
||
exec "/usr/local/bin/moshiro-$role" "$@"
|